What the CoE Starter Kit is
The Center of Excellence (CoE) Starter Kit is a downloadable solution of cloud flows, model-driven and canvas apps, and Power BI dashboards that Microsoft publishes but does not formally support (community-maintained). Installed into a dedicated environment, it uses the admin connectors and APIs to sync an inventory of every environment, app, flow, connector, connection and maker in the tenant into Dataverse, then builds governance on top.
| Component | Purpose |
|---|---|
| Inventory (sync flows) | Pull all envs/apps/flows/connectors into Dataverse nightly |
| Power BI dashboard | Estate-wide view — sprawl, orphans, premium usage |
| Compliance apps | Ask makers to attest business justification for apps |
| Audit-log sync | Bring Power Platform activity into the inventory |
| Archive/cleanup | Flag and remove inactive/orphaned assets |
How it drives governance
The kit operationalises the concepts in this module: it finds the orphaned flows, the ungoverned default-environment apps, the premium-connector usage before a true-up, and it can automatically email makers to justify or clean up assets. It is the practical answer to 'we have no idea what's in our tenant'.
Failure modes
- It is unsupported and self-hosted. The kit runs as flows owned by an admin account — if that account is disabled or its connections break, the inventory silently goes stale (the govern-the-governor problem).
- It needs a service principal / broad admin rights to read the whole tenant; that identity is itself a high-value target and must be governed.
- Inventory lag. Sync is periodic (typically nightly); assets created and deleted between runs can be missed. It is a snapshot, not real-time.
- Requires premium/Dataverse licensing in its host environment — governance itself has a licence cost.
What to watch (proofs)
- CoE inventory freshness: the sync flows' run history (
Get-AdminFlow/ admin center) — a failed or stalled sync means blind governance. - The service/admin account behind it: its connections
(
Get-AdminPowerAppConnection) and privilege — the single point of failure. - Coverage vs reality: CoE's app/flow counts vs a direct
Get-AdminPowerApp/Get-AdminFlowsweep — divergence exposes inventory gaps (serv365 provides an independent nightly scan rather than trusting a single in-platform inventory). - Compliance attestation backlog: apps without a recorded business justification — the maker-accountability queue.